skysight-inc/HackerNews huggingface dataset:
"Almost certainly" seems like a stretch.

- The arguments regarding Traynor's behavior on Twitter carry absolutely no water with me and sound like totally average behavior. It's not very intuitive that only people you follow can message you.

- Police in America frequently decline to investigate things like harassment and petty theft in favor of spending their time elsewhere. I don't know about Ireland, but it seems very unsurprising (if disappointing) that they would ignore his complaint.

The only compelling reason to disbelieve anything is the whole home address discovery thing, which does seem very strange. Although it's possible that there was some convenient coincidence that permitted the identification, probably that part of the story was embellished or false somehow. (edit: After looking at replies, I changed my mind, I think it's more likely mostly true. There's a lot of plausible avenues of discovery given the length of the alleged abuse.)

The rest, however, seems very conventional and I don't see a good reason to disbelieve it.
While a trained locksmith could probably get past my deadbolt, a random hacker from $current_unpopular_country can't. (Note: this isn't counting non-locksmiths that can also pick a lock). So, using something like this does carry a bigger (if slight) risk. I'm not sure if I'd necessarily trust a relatively new company with controlling my deadbolt.

Then again, I also have a similar setup using an HID tag reader/arduino/relay to control access to my garage door, so it's not like I'm against the technology. It's more that I'm worried about outsourcing the security of my house.

Honestly, the threat profile to me personally is pretty low, but it's still not something I'm 100% comfortable with.
I think this would make a really neat mobile game! If you're interested in building it into one, drop me a line (ashu@makegameswith.us)
I bike to work and my wife is a stay at home mom. I pretty much never carry keys on me.

I ALWAYS have my phone though. Quite frankly, I look forward to the day when my phone replaces my access badge/key-card at work.

Of course there is the arguement "but someone could take your phone and access the MDF!" -- well they can always steal my access badge as well.

I have forgotten my badge countless times in my career though I have forgotten my phone all of once.
The Project is pretty awesome, and the guys/gals on the project are hardcore believers and doers. I just pitched in a little, hope this project and ones like it gets lots of traction.
I found this overview http://keccak.noekeon.org/ quite approachable. Especially the pdf linked here : http://keccak.noekeon.org/Keccak-reference-3.0.pdf
I heard about this case on NPR when a biographer of his was interviewed. The biographer cited an interesting motive for the lawsuit. This guy had made a fortune selling arms to shady governments. His bosses in the CIA liked that line of business, and wanted it for themselves...
I have panicked several times after I put my MIFI device in my pants pocket instead of its specific pocket in my backpack. And the same when I place my wallet in my front pocket instead of the back after a transaction.
>I've actually encountered keypads where the order didn't actually matter

If the order really doesn't matter, then that counts combinations twice (1234, 1243..). There are 10000 possible 4-digit codes, 5040 permutations, and actually 210 combinations.
> The clarified login error message finding is way more interesting than the vague platitudes on branding and security

The part about security isn't platitudes. Not displaying informative messages in response to failed logins is a security orthodoxy, something you are almost always told is a compulsary practise if you care about security. So a very key part of the story here is that they abandoned this standard security practise as a tradeoff in favor of usability. Whether this ever bites them or to what extent is something we may never know the answer to. So we have been told the good outcome of their tradeoff and not the bad side. It sounds to me like it was worth it, but I wouldn't like every web service to jump on this uncritically.
> Except for the pendant comment. That's just a case of taking yourself too seriously. Yet another nail in the coffin of his credibility.

What nails? You're treating his every statement as suspect by default based on the racial, sexual and political stereotype you are projecting onto him. Judging by the admittedly superficial evidence of your post history, you are a Randian libertarian with a stereotypical dislike of women and racial minorities who claim victimhood. You must be used to people automatically classifying you by a stereotype and refusing to engage with you. If only in that respect, you're exactly like him and others whose arguments you reject offhand.

Elsewhere in this thread you explain that your skepticism is based on personal experiences. Many people reading that will assume you're lying or that your view of what happened was warped. How does that make you feel? Like a victim of stereotyping? You may even write off those people as dumb liberal motherfuckers.
p.s. in the spirit of pedantry:

看板 (kanban) = "signboard";
板 (ita) = "board"

From a wikipedia glance, "kanban" was used here in the sense of a particular process-control method, and although the term "kanban" here is pretty clearly derived from 看板, I suppose now it could be considered a distinct term.

Still, "kanban board" really sounds redundant...
Nope, all the nay sayers in middle school.
> And doing so on a regular basis

Ever wonder why some blogs post n times a day?

"My job was to write twelve posts a day about 'media gossip,' which meant anything unpleasant or otherwise intriguing about anyone who had power in any Manhattan culture industry. There had to be enough posts so that whoever was sitting at my old desk at the publishing house, and everyone in Manhattan like her, could read something new when boredom struck."

Excerpt from book by Emily Gould, ex-Gawker, infamous blogger
I agree it's not his responsibility (but explained why he should anyways in response to larrybobsf).

I also said that in this case, where it was systemic and tolerated, he made the right decision to escalate it to HR and the court system who actually have the power to do something about it.
The statements made to this person seem innocuous to you?
Change your tampon and find another job.
I hardly think this is a big deal. The cost for assembly is low anyway. Even though the laptop might be assembled in the US, the major parts of a laptop (chip, case, screen) are still made in Asia.
I know developers (including myself on a rare occasion - i tend towards custom development) who are doing far better than $70/hour for Drupal development in NYC.

Although I don't know many successful developers who explicitly sell themselves as "[Framework] Developers". More often than not, when shooting for a higher rate, it seems to sell better as someone who provides a full solution, which May include specific frameworks if necessary.
Man, you just read my mind. Sunday I was thinking of making something like that... Exactly that.

It could be a PaaS or something to get two or three dudes with different abilities together and provide them some basic tools to manage their stuff.
Nobody is? Huh? GP implies pretty heavily that anyone who disagrees with the article is sexist. That is suppressing opposing ideas by using unfounded accusations like sexism.

Calling out shitty behaviour is OK, and should be done, so hopefully people will change their behaviour or other come to realise such behaviour is not acceptable. However, taking the stance that everyone, who disagrees even on exactly how or why the behaviour is unacceptable, is sexist, is shitty behaviour in itself.

We're not supporting the behaviour in the article (at least, I hope so). What is happening here is that people disagree with the article exactly why it's not OK. And that this behaviour is not a symptom of endemic sexism in software. So in se, I don't even think the article (and GP) are completely wrong, only that I disagree that this is sexist.

Your style of reasoning and arguing is very familiar to me, and it's not unique to feminists. If you're unable to make compromises, or look at an issue from another point of view, you will stand alone soon enough. Nobody is asking you to give up your ideals, only that you do not call people, who in essence agree with you but maybe for the wrong reasons, sexists and chauvinists.
The author of this article is almost certainly trolling.

It's perfectly logical that the victim would change his Twitter behavior even after discovering the identity of the harasser. If your car were stolen but then recovered and the thief arrested, would you stop locking it? After all, the threat has been eliminated...

Just because you cannot traceroute an IP to a physical address doesn't mean you can't determine where an IP is being used with a high degree of confidence. If the parents were indeed friends of the victim, any email correspondence sent from their home connection would include their IP in the headers.

The biggest flaw however is that there is no plausible motive given for the victim to lie. Sure, it's possible that he lied, but why would he?
I don't think I learned anything from the blog post. It was already being featured by Google. May be this is just an ad.
I don't think it is fair to throw all Drupal developers into a bucket that has them rarely writing code and mostly just clicking around. We have a Drupal Role for people that only do what you describe. We call it Site Admin. They get access to all the clicky parts but don't do any actual programming. I'm never bored with Drupal. Frustrated yes... but never bored.
The only strong case here is in the IP address geo-identification.

Traynor could identify them if he were to cross validate the IP address location with a list of known friends and family - people of whom would have Traynor's personal address.

But Traynor should have suspected his friend - not his friend's teenage son. That's the part of the story that doesn't add up.
IPv6 Presents A Security Paradox For The Network
it all depends. Example, if you want to assign a role to a new user when he signs up you can install http://drupal.org/project/autoassignrole module which does about 10 more things or just write one hook_user function.

If you install a module for every piece of functionality soon you'll end up with a huge codebase and the hell the author is describing.
I would add this to the complaints:

- NOT AMENABLE TO SOURCE CONTROL

Half the code lives in the database, configuration is all mixed up with content, and there's no reliable programmatic way to extract it. It makes doing deployment a nightmare.

And the worst part? Drupal developers by and large have such a narrow range of experience that they don't even know what they are missing. They have no idea what good coding standards look like, a lot of them don't even have a development/production separation: they just hack away on the live site with no source control or backup. And no one writes tests, or sees why they would be useful.

Some of the big professional drupal shops appear to have basically written their own cms on top of drupal, with a bunch of terrible hacks to try to make source control kind of work, and just use the drupal name basically as a marketing technique.

So glad I don't have to deal with any of that insanity any more.
So you think one can like the new keyboard, right? I heard many long-time ThinkPad users were dissatisfied with the new keyboard. I'm on older X series and really contemplating whether I should get X220 or X230 in the future. Apart from the keybord type, why the hell do they dissolve the six-key Ins/Del/Home/End/PgUp/PgDn block ?!
I'm sure if the tone of the post was milder, most of the comments here would be supportive.

Why do you believe that? Have you been in a bunch of pitch perfect productive conversations about racism? In my experience, when one tactic for derailing conversations about racism fails people just pick up another one. In this conversation you see many such strategies at play:

I see all of these as efforts to not talk about the actual structures being criticized in the post:

* Saying the tone makes the message unlistenable
* Talking about the extent to which the post is effective activism ("he would be more effective if...")
* Stopping conversation do to perceived insurmountable "bias"
* Refocusing on other forms of racism (like the dumbwhite* comments)
* Talking about whether people are "racists" and refocusing on their overall character.

It goes on and on. Pitch perfect tone doesn't get you through that wilderness.

And honestly, when someone has been through something so traumatic, demanding perfect pitch is heartless.
Steam down right now?
"new favorite word" not "favorite new word". Also, see http://xkcd.com/1053/
Well, you'd be without feedback alot, state of the art in type recovery is nowhere near 99%. Your libraries can exploit the flexibiliy of a dynamic language (meta programming, crazy unions) and make the job much harder. Typescript seems very interesting in the way they handle type retrofits on libraries, but I haven't really absorbed it yet.
>"instantly DOUBLED our install rate"

They are talking about their install rate not CTR.
One plausible scenario for the IP address is that he had comments from his friend on his blog, and then baited the troll to also comment there. The IP addresses would then be identical, providing the identification. Dynamic IP addresses would pose a problem, but most broadband has (semi-)fixed addresses, and even dynamic addresses would come from the same range so could be enough to trigger a hunch.

Rather than embellished, I'd more easily suspect the story of being selective. I just can't imagine someone not expressing anger when confronted with someone who harassed you.
This article is copied in its entirety from:

http://www.resistradio.com/news/questioning-the-trollocaust-...

as admitted in the intro. Why link to a copy instead of the original?
"Keccak, created by Guido Bertoni, Joan Daemen and Gilles Van Assche of STMicroelectronics and Michaël Peeters of NXP Semiconductors"

I don't think there will be any issue with regards to some early adopters. Maybe even a concideration with regards to common hardware usage like smartcards at some level.

But whilst your right about SHA-2 not being broken and making the rush to SHA-3 moot, it does not stop marketing types getting sales over SHA-2 only complient. In that it will be marketing and drive for sales and standing out that will drive it into market with all things being as they stand. Besides, everybody likes a plan B to fall back upon.
ShowHN: Stumble Upon Links in Your Twitter Feed (Open Source)
This seems unreasonable, since he was presented with evidence that showed a strong correlation between more choices and fewer errors. In hindsight, this turned out to not be a causal relationship, but the CEO had no way of knowing that at the time.
I miss 4:3 on X60s/X61s because it was so much smaller. I like how widescreen makes keyboard bigger though; I just wish for more portable laptop, more like Air but still user-configurable.
I would expect it to be Cthulhu, myself. So, maybe not fiery, but earth-destroying demon/alien fits.

https://en.wikipedia.org/wiki/Cthulhu
you can use the features module in drupal and have the best of both worlds. You click to get a prototype quickly, then you export the functionality to a module with drupal and keep track of changes with git.
0. He didn't change his behavior during the abuse, when he could have trivially stopped it by unfollowing. If your car was stolen, would you keep the loaner unlocked before your car was even recovered?

1. Only if they use non webmail

2. To sell a story. The default assumption should always be that tales like this are false or at least extremely embellished.
Well perhaps it's just as much a flaw that there wasn't really a motive for the troll. I think it's very likely that something is missing from the story to explain why he was targeted in particular.
I believe it was noted in some older thread that the reason a lot of people use the web version, is because the native versions were so slow and unresponsive. So there are lots of web users, party because they were pushed away from native — not because they chose web.
What about handling single sign on for multiple applications - what do I put in the cookie if anything?
If I am encrypting a cookie what scheme? What key rotation? How many failures of a cookie to decrypt is suspicious

What about password reclamation - do I keep the answers to their grandmothers maiden name in the same database? What about adding a new email address to the list of ones I will mail a password reset token to - do I force them to prove ownership of the first email address before adding the second ? Or will a SMS to their phone do?

I am sure I am missing a hundred items and none of them are to do with bcrypt vs scrypt. Thus is hard stuff and I am avoiding most of it with the magic words "Mozilla persona" but I still don't know how to do sso well. I can do not badly but not well.

Edit: I am being a bit snipy and I apologise but I know I am in deep waters and would be happier if NIST were producing reference implementations. Perhaps actually they have - there is kerberos. If you want a key visit room 303 with your passport
Because the original has unreadable formatting and color.
Ask HN: Cheapest way to store 6TB online?
What is the cheapest way to store 6TB of key-value data online?

The data is accessed via random lookups and needs to maintain <0.5s service times per lookup and can expect around 200 concurrent accesses at any time.

It's currently hosted in a small Cassandra cluster and that gives lookup times of 15ms-20ms, well within acceptable limits. However there's no reason it couldn't be moved to another indexing system (it could even be moved to a suitably tuned filesystem with little effort).
I hadn't known that history; fascinating.

The Wikipedia entry for cross burning indicates that it has been handled negatively in the last five years–that is, the act of cross burning was not protected as speech–and makes no mention of Brandenburg v. Ohio. That Wikipedia entry does not indicate that cross burning was a significant question at stake in the case, since the matter being decided was the constitutionality of the Ohio statute.

Admittedly, that's just a reading of Wikipedia and I have no training in law of any kind, but it doesn't seem as provocative as you put it.
Because I'm functioning on little sleep and managed to miss that.

If one of the mods could change the URL to point to the original I'd be grateful.
Think of a problem that you have in your life, then think of a way to solve it. If other people have the same problem, then you have a business idea.

The hardest part is the execution.
Because from fingerprints and similar gunk on the pad you can tell which 4 digits were used.
To be fair, there certainly is a motive for him to lie, and that's exposure/fame/internet celebrity/etc. Not that I think that he lied, but let's be honest, he certainly got a lot of attention from the story...
Those are good point. I guess I was more curious about how the data is stored — say someone 100 years from now picks one of these up and wants to read the data. Will the format in which it's stored prevent them from doing so?
Why would his friend be a more likely suspect? Psychopathic children are more common than psychopathic friends.
To preface, let's say that "application-scale" means something like the following: your server outputs a single html file that only contains references to js files and css (i.e., the minimum to get the app to work right), from then on all data operations are ajax calls to a server side API, while the entire state of the app, all UI/markup components included, is maintained via JS.

I've worked on a couple of these applications, they almost always end up having some fake-class system that provides mechanisms for encapsulation, code sharing, and namespacing. There's often almost a hundred of these fake classes defined with thousands of instances living in memory. I grant you that you can use things like the module pattern to accomplish those requirements -- in fact, if you couldn't, then I wouldn't be here talking about it because I'd be writing Java applets instead. But the lack of having static typing to catch simple errors and enabling basic refactoring tools (like renaming something without having to use a regular expression which took 2 hours to "perfect", or simply switching argument orders, etc) was the absolute worst. I've spent countless hours debugging problems that occurred because something like a string was accidentally passed when an array was expected, and only having the actual runtime error occur 50 function calls later because something like "cat"[0] was working fine up to that point. Static typing would have caught that before I even ran the app.

Anyway, these types of apps perhaps aren't as common as websites, but they exist and therefore there is a need for statically typed languages for the browser.
You haven't taken into account that by looking at the keypad you can tell which digits are actually used.
I agree 100%. That makes it a lot less boring because you feel you are doing something useful not only for yourself.

That's also why Drupal has huge amounts of contributed modules and developers. Lots of people who do just that. Drupal is the Linux of the CMSs.
"It will include a plethora of innovations to come that will further make it clear that big things are on the road ahead."

All Things D's writing, and hence credibility, is one butter patty away from the big dirt nap.

I've attempted to unpack that sentence and it's turtles all the way down.
Oh we can come up with a zillion questions ...

Drive up the rageviews?

Seems like 'graunwatch' is all about bashing the Guardian and this is an anti-Guardian story kinda?

A more interesting question is does the author know and consent to the wholesale copying? Does that change the story?
Ad 1: webmail can show IP as well; e.g., hotmail has X-Originating-IP header. It makes a lot of sense to include such information for obvious abuse tracking purposes.
This is a really simple hack to browse links in a Twitter feed the same way Stumble Upon works.

Comments on the code are much appreciated since I know there are several different ways to do this. https://github.com/JohnCoogan/NewLinkForMe
Copenhagen Suborbitals Release Snowmix, an Open Source Video Mixer
It's not very intuitive that only people you follow can message you.

But after you've received some hate messages, it also sounds like the kind of thing that you'd learn pretty quickly.

In other words if you're making up a story, it is the kind of detail that you'd not noticed you'd gotten wrong. But if you're actually harassed, it is the kind of thing that wouldn't keep happening to you for years.

Seems like a good reason to conclude that the story is made up.

As for home address discovery, that bothered me far less. If I had tracked someone down to 3 IPs, one of which was close, I'd go looking for evidence that there was a personal connection. One of the standard things that I would think of is to look through all received emails, and look for the IP address there.

That would indeed track it down reasonably reliably to a specific household without any need for a court order. And if the person that I did this for didn't understand what I did, confused explanations about how it was done are only to be expected.